CVE-2026-3318 is an open redirection vulnerability in the latest demo version of the Cradle eCommerce platform. The flaw exists in the login form endpoint where the 'returnUrl' parameter is not properly validated, allowing attackers to redirect users from the legitimate site to arbitrary external URLs. This can be exploited to deceive users into visiting malicious sites.